kubernetes-sigs/cluster-api
Embedding cert-manager into CAPI for smaller footprint/less upgrade deps
Aperta
#7443 aperta il 23 ott 2022
help wantedkind/featurepriority/important-longtermtriage/accepted
Metriche repository
- Star
- (4267 stelle)
- Metriche merge PR
- (Metriche PR in attesa)
Descrizione
I recently realized that the 3 cert-manager related processes we use in CAPI are actually not required when a cluster is running, and only required, i believe:
- on upgrades
- on creation of a new cluster
User Story
As a CAPI User I'd like to minimize the number of containers I need to run persistently in my cluster, and thus i'd like a like a default "batteries included" certificate management solution running in one my essential capi pods... so that i dont need to run certmanager after cluster creation.
i.e. the dumbed down version of this would be something like... "lets just vendor certmanager and use it when needed".
Detailed Description
I think these 3 services:
- ca-injector
- webhook
- certmanager
Can
- all be run as one off processes on startup
- invoked as needed during upgrades
- be non-existent at other times ?
Anything else you would like to add:
/kind feature